We take care of your data

By now, you have probably heard a lot about the new data protection laws which came into effect on 25 May 2018. Here is a short summary, stating how ABRSM is becoming GDPR compliant.

ABRSM is a Data Controller in relation to our exams, and we are required by law to process data in accordance with GDPR. We have issued a statement about ABRSM’s role as a data controller and you can read about it on our website.

We have analysed our processes and executed an action plan which includes the following:

You may notice some small changes in our exam processes, especially regarding any personally sensitive data that we hold about you.

Want more information?

You’ll find a list of useful links on the right. The ICO’s guidance clearly explains your rights as an individual. Please read this and our Privacy Policy, then if you have any questions, please contact us.

We are committed to keeping your data safe and secure and ensuring that you receive the best possible service from ABRSM.

when you, your parent or guardian, your tutor or your school communicate with us by post, telephone, SMS, email or via our website – for example, in order to book or make enquiries about a course or an exam, or when you participate in a discussion forum on the website;

from our exam centres – for example, in relation to exams that you have booked or taken at a particular centre;

when you purchase products from our online shop;

from the information you provide to us when you make an application to work for us, or from third parties such as your previous or current employers so we can verify details about you;

from third parties who collect personal data on our behalf, such as international examination boards (e.g. the Hong Kong Examinations and Assessment Authority), or ticketing agencies and other contractors where, for example, they assist us in running events such as conferences;

as you interact with us in other ways – either as a student, a contractor, or in any other capacity.

We ask you for Special Educational Needs (SEN) requirements, which may require supporting health and medical evidence, in order to consider making reasonable adjustments for candidates taking exams. Exam candidates must actively give consent to ABRSM to retain any supporting evidence for reasonable adjustments for five years.

If candidates choose not to give permission to ABRSM to retain supporting evidence, or do not respond to the request for ongoing consent, ABRSM will retain the supporting evidence only for the duration of the current session (a maximum of six months from the closing date for examinations) and the candidate will need to resubmit supporting evidence for any future exams requiring reasonable adjustments.

We need to collect and use relevant information about young people so that they can enter exams and competitions, attend events, and sign up to receive or use some of our services. If you are aged 18 or under, please get your parent/guardian's permission before you provide any personal information to ABRSM.

Applicants from the UK, Singapore and Malaysia can enter exam candidates online. We also process paper entry forms.

Exam entries are stored on the ABRSM secure web server and a copy of this data is transferred daily onto our UK-based system. All online information is held purely for the purpose of exam entries and is retained on this secure server so that applicants can view their past entries.

We use the contact information provided in online and paper application forms to ensure that examination schedules, results and certificates are forwarded to the correct address. In the event of any problems or complications with exam entries, this information is also used to contact the applicant. We keep accurate records of applicant and candidate exam history, which allows us to provide a quicker and more effective service to our applicants.

We request financial information from online applicants (such as credit card number and expiry date). This information is used to process payments for examination entries and administration. The online entry form is held on a secure HTTPS site (demonstrated by the visible padlock logo).

Diploma Exam payments for UK applicants as well as administrative payments such as duplicate certificate requests are processed by ePDQ Lite and paid to ABRSM via Barclays Merchant Services. In accordance with the Payment Card Industries Data Security Standard (PCI DSS), ABRSM transmits this data via a secured, isolated terminal that only has access to ePDQ Lite over HTTPS. In accordance with the Payment Card Industries Data Security Standard (PCI DSS), ABRSM does not process, transmit or store this data. A truncated PAN (Primary Account Number) that consists of the first and last four digits of the card number is provided by the payment gateway provider for reporting and reconciliation purposes.

Purchases from our online shop are processed by a third party, Boosey & Hawkes Music Publishers Ltd. To find out more about how your data is used for the purpose of buying publications on this shop, please see their privacy policy.

If you choose to register for and attend one of our courses or events, we will use the personal information that you provide to manage your attendance.

We will request your explicit consent to hold and use any medical or religious information that you may provide in relation to your attendance. This may include, for example, information about any disabilities you may have, any specific dietary requirements, or your availability around religious holidays.

If you choose to participate in an ABRSM discussion forum, apart from your username and the content you post, other personal information you provide will not be made available to those who also have access to that discussion forum. Each participant’s opinion on a discussion forum is their own and should not be considered as reflecting the opinion of ABRSM.

If you join the ABRSM mailing list, we will send you information that we hope will be of interest to you. If you choose to provide your email address (or address and postcode), interests and/or your instrument(s) of specific interest, we will provide you with information of direct relevance to your country, area and personal music interests.

You can opt-in to receive information by email (or by post in some cases), which may include copies of new syllabuses, new publications and other information on specific instruments and events that you have informed us would be relevant to your interests.

We use cookies and log files on our website (abrsm.org) to store information about how you use our website.

A cookie is a piece of data stored on the user’s computer tied to information about the user. This enables us to create a profile that details your viewing preferences. We use your profile to tailor your visit to our website to make navigation easier and direct you to information that best corresponds to your interests and country. Cookies are used to display exam dates, fees and contact details of ABRSM representatives for that country. Read our cookie policy.

Aggregate information is collected from users using our own web tracker. This information includes users' Internet Protocol (IP) addresses, browser type, internet service provider (ISP), referring/exit pages, platform type, date/time of visit, number of clicks, error pages and number of unique visits. This information is not linked to personal profiles or to personally identifiable information provided by users. We use it to analyse visitor trends and use of our website, to administer the website, and to gather broad demographic information of our website users.

We award scholarships, awards and bursaries to outstanding students at the Royal Schools of Music and elsewhere. We process personal information of applicants provided to us by the Admissions Boards at the Schools in order to assess applications.

We retain personal information of successful applicants in order to manage scholarships. We process these awards using information captured during the exam process. The names of those students who have been awarded scholarships, bursaries or awards are published in the ABRSM Annual Review.

If you provide us with information about yourself such as a CV or resume in connection with a job application or enquiry, we may use this information to process your enquiry. We will not store this information for any purpose other than that relating to your application.

We communicate with our customers on a regular basis to provide requested services, and in regards to issues relating to their account we reply via email, post or phone in accordance with their wishes.

We will seek your consent to process your personal information when appropriate. We will normally ask for your consent to process any medical or religion-related information that you provide to us, for example in relation to an exam entry or attendance at an event. We will process your personal information without necessarily obtaining your consent where another legal basis exists.

We may process personal information because it is necessary for the performance of a contract to which you are a party (or to take steps at your request prior to entering a contract). For example, we may process your personal data (as is necessary for our exam regulations and related contracts):

to provide you with an exam, course or other product that you have requested from us;

to process enquiries and complaints.

In this respect, we may provide your personal data to third-party service providers who we engage to provide these services to you – for example caterers, schools, conference and course providers, referees, tutors and examiners. We may also share your information with:

our bank in order to process a payment;

our professional advisers (such as our legal advisers) where it is necessary to obtain their advice;

our IT support and data storage providers.

We may process personal information where it is in our legitimate interests to do so and where we are confident that such processing will not infringe on your rights and freedoms. Our 'legitimate interests' in this context include promoting musical achievement and education through examination and assessment, professional development of music teachers and the provision of published resources, for example:

to train our staff and to improve our website and the services that we offer;

to provide you with an exam, course or other product that has been arranged on your behalf by a third party – for example, if your parent, school or tutor has instructed us to deliver your exam or a course that you will attend;

to analyse use of and to administer our website;

to process your application, a scholarship or bursary;

to research our market and to promote our goods, services and events by post, telephone and email, except in situations where it is required or appropriate to seek your specific consent.

In this respect, we may share your data with third-party organisations who will process personal information on our behalf – for example, a mailing house, our website administrator or printers.

ABRSM will also share personal information with ABRSM Publishing so that ABRSM Publishing can contact you about exam-related products and services – for example, printed sheet music or theory books.

Where required, we will process personal information in order to comply with our legal obligations. In this respect, we may use your personal data to comply with subject access requests, tax legislation, for the prevention and detection of crime, and to assist the police and other relevant authorities with investigations (including criminal and safeguarding investigations).

We may need to collect or send some personal information outside of the EEA – for example, to facilitate the exam process and for arranging conferences. If we transfer personal information to countries or jurisdictions that may not be subject to an adequacy decision granted by the European Commission, we will take measures to comply with our legal obligations and all reasonable steps to ensure that your personal information is treated securely and in accordance with this privacy policy. For example, we will enter into standard contractual clauses that have been approved by the European Commission.

For more information about international transfers of personal data (or to request a copy of the standard contractual clauses), you can contact our Data Protection Lead, Sue Cambridge, by emailing [email protected] or writing to Sue Cambridge, ABRSM, 4 London Wall Place, London, EC2Y 5AU.

We take every precaution to protect our customers’ information. ABRSM holds and maintains the National Cyber Security Centre’s Cyber Essentials Plus accreditation that validates our commitment to secure configuration and action against cyber security threats.

When our online examination entry form asks users to enter sensitive information (such as credit card number and expiry date), that information is encrypted and protected with industry-standard Secure Socket Layer software. While on a secure page such as our online entry form, the lock icon on the bottom of web browsers such as Netscape Navigator and Microsoft Internet Explorer becomes locked, as opposed to unlocked or open when users are just ‘surfing’.

We use SSL encryption to protect sensitive information online and do everything in our power to protect user information offline. Personal information is restricted in our offices and made available only to the appropriate departments. All employees are provided with a unique username and password in order to gain access to this information.

Our servers that store personally identifiable information are password-protected and held in a secure environment in a locked facility. Regular backups are made of this data and these are securely stored off-site and managed by Iron Mountain, who ensure rigorous protocols and logistics for delivery and retrieval of media to and from designated ABRSM IT staff.

If you no longer wish to receive communications about products and services from us, please contact [email protected]. You can also unsubscribe at any time to emails that we may send to you about the products and services that we think will be of interest to you.

You also have the right to:

request a copy of the information we hold about you (requests should be addressed to [email protected], and we will respond within one month);

tell us to change or correct your personal information if it is incomplete or inaccurate;

ask us to restrict our processing of your personal data or to delete your personal data if there is no compelling reason for us to continue using or holding this information (and, where our processing is based on your consent, you may withdraw that consent without affecting the lawfulness of our processing based on consent before its withdrawal);

receive from us the personal information we hold about you that you have provided to us, in a reasonable format specified by you, including for the purpose of you sending that personal information to another data controller;

object, on grounds relating to your specific situation, to any of our particular processing activities where you feel this has a disproportionate impact on you.

Please note that we may be entitled to refuse requests where exceptions apply – for example, if we have reason to believe that the personal data we hold is accurate or we can show our processing is necessary for a lawful purpose set out in this privacy policy.

Please contact [email protected] or phone us on 0207 636 5400 if you think our records are inaccurate. If you wish us to update or delete your personal information, or if you wish to exercise your other rights under applicable data protection laws, please contact Sue Cambridge by emailing [email protected] or writing to Sue Cambridge, ABRSM, 4 London Wall Place, London, EC2Y 5AU.

We will retain your personal information in accordance with our retention policy, which follows the principle of retaining information for only as long as is necessary. You can request a copy of the retention policy by emailing Sue Cambridge at [email protected] or writing to her at ABRSM, 4 London Wall Place, London, EC2Y 5AU.

If you are not satisfied with our response to any query you raise with us, or you believe we are processing your personal data in a way that is inconsistent with the law, you can complain to the Information Commissioner’s Office through their helpline: 0303 123 1113.

Useful links

Contact us

Marketing Department

T +44 (0)20 7636 5400

Your name

Email

Applicant no. (if applicable)

Phone

Message

Supporting the teaching and learning of music in partnership with the Royal Schools of Music:Royal Academy of Music | Royal College of Music | Royal Northern College of Music | Royal Conservatoire of Scotland